{"id":"CVE-2026-45822","aliases":["GHSA-vcc3-ghjq-m6fr"],"url":"https://o3.security/vulnerability/CVE-2026-45822","summary":"decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input","details":"### Impact\nAn attacker who can supply input to `decodeUriComponent()` (directly or via a dependency that uses this package on URL/query/path data) can cause excessive CPU usage and application unresponsiveness. This is an availability issue; there is no known memory corruption, data disclosure, or remote code execution impact.\n\n### Patches\nUpgrade to `decode-uri-component@0.5.0`.\n\n### Workarounds\nLimit the size of the input.","published":"2026-06-30T08:05:36.399Z","modified":"2026-09-01T21:56:10.638443946Z","cvss":null,"epss":{"score":0.00507,"percentile":0.41228,"asOf":"2026-09-01"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"decode-uri-component","fixedVersion":"0.5.0"}],"fix":{"url":"https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005","label":"SamVerschueren/decode-uri-component@fa479da"},"references":[{"type":"WEB","url":"https://github.com/SamVerschueren/decode-uri-component/blob/00662938dc7c6241547ae8abce7785cc13ffd3f6/index.js"},{"type":"WEB","url":"https://www.npmjs.com/package/decode-uri-component"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/45xxx/CVE-2026-45822.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-45822"},{"type":"FIX","url":"https://github.com/SamVerschueren/decode-uri-component/commit/fa479dafeede7bedf04e5c89aa78f2a78c664005"},{"type":"WEB","url":"https://github.com/SamVerschueren/decode-uri-component/security/advisories/GHSA-vcc3-ghjq-m6fr"},{"type":"PACKAGE","url":"https://github.com/SamVerschueren/decode-uri-component"},{"type":"WEB","url":"https://github.com/SamVerschueren/decode-uri-component/releases/tag/v0.5.0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-01T21:56:10.638443946Z"}}